CVE-2021-47305 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: dma-buf/sync_file: Don't leak fences on merge failure Each add_fence() call does a dma_fence_get() on the relevant fence. In the error path, we weren't calling dma_fence_put() so all those fences got leaked. Also, in the krealloc_array failure case, we weren't freeing the fences array. Instead, ensure that i and fences are always zero-initialized and dma_fence_put() all the fences and kfree(fences) on every error path.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce
https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27
https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8
https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902
https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8
https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435
https://lore.kernel.org/linux-cve-announce/2024052127-CVE-2021-47305-e1c5@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2021-47305
https://www.cve.org/CVERecord?id=CVE-2021-47305

History

No history.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-21T14:35:25.345Z

Updated: 2024-11-04T12:03:21.801Z

Reserved: 2024-05-21T13:27:52.133Z

Link: CVE-2021-47305

Vulnrichment

Updated: 2024-08-04T05:32:08.577Z

NVD

Status : Awaiting Analysis

Published: 2024-05-21T15:15:18.177

Modified: 2024-05-21T16:54:26.047

Link: CVE-2021-47305

Redhat

Severity : Low

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2021-47305 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-47305", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T13:27:52.133Z", "datePublished": "2024-05-21T14:35:25.345Z", "dateUpdated": "2024-11-04T12:03:21.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:03:21.801Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sync_file: Don't leak fences on merge failure\n\nEach add_fence() call does a dma_fence_get() on the relevant fence. In\nthe error path, we weren't calling dma_fence_put() so all those fences\ngot leaked. Also, in the krealloc_array failure case, we weren't\nfreeing the fences array. Instead, ensure that i and fences are always\nzero-initialized and dma_fence_put() all the fences and kfree(fences) on\nevery error path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma-buf/sync_file.c"], "versions": [{"version": "a02b9dc90d84", "lessThan": "19f51c252933", "status": "affected", "versionType": "git"}, {"version": "a02b9dc90d84", "lessThan": "e0355a0ad31a", "status": "affected", "versionType": "git"}, {"version": "a02b9dc90d84", "lessThan": "41f45e91c92c", "status": "affected", "versionType": "git"}, {"version": "a02b9dc90d84", "lessThan": "0d514185ae79", "status": "affected", "versionType": "git"}, {"version": "a02b9dc90d84", "lessThan": "19edcd97727a", "status": "affected", "versionType": "git"}, {"version": "a02b9dc90d84", "lessThan": "ffe000217c50", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/dma-buf/sync_file.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.241", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.199", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.135", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.53", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.13.5", "lessThanOrEqual": "5.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8"}, {"url": "https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8"}, {"url": "https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902"}, {"url": "https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce"}, {"url": "https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27"}, {"url": "https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435"}], "title": "dma-buf/sync_file: Don't leak fences on merge failure", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T17:37:39.251165Z", "id": "CVE-2021-47305", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:39:09.946Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.577Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T05:32:08.577Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-47305", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T17:37:39.251165Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T17:37:40.365Z"}}], "cna": {"title": "dma-buf/sync_file: Don't leak fences on merge failure", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a02b9dc90d84", "lessThan": "19f51c252933", "versionType": "git"}, {"status": "affected", "version": "a02b9dc90d84", "lessThan": "e0355a0ad31a", "versionType": "git"}, {"status": "affected", "version": "a02b9dc90d84", "lessThan": "41f45e91c92c", "versionType": "git"}, {"status": "affected", "version": "a02b9dc90d84", "lessThan": "0d514185ae79", "versionType": "git"}, {"status": "affected", "version": "a02b9dc90d84", "lessThan": "19edcd97727a", "versionType": "git"}, {"status": "affected", "version": "a02b9dc90d84", "lessThan": "ffe000217c50", "versionType": "git"}], "programFiles": ["drivers/dma-buf/sync_file.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "custom"}, {"status": "unaffected", "version": "4.14.241", "versionType": "custom", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.199", "versionType": "custom", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.135", "versionType": "custom", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.53", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.13.5", "versionType": "custom", "lessThanOrEqual": "5.13.*"}, {"status": "unaffected", "version": "5.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/dma-buf/sync_file.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/19f51c2529339280d2c8c6427cd3e21ddf1ac3f8"}, {"url": "https://git.kernel.org/stable/c/e0355a0ad31a1d677b2a4514206de4902bd550e8"}, {"url": "https://git.kernel.org/stable/c/41f45e91c92c8480242ea448d54e28c753b13902"}, {"url": "https://git.kernel.org/stable/c/0d514185ae792d3a1903c8e1a83899aa996705ce"}, {"url": "https://git.kernel.org/stable/c/19edcd97727aae9362444a859a24d99a8730cb27"}, {"url": "https://git.kernel.org/stable/c/ffe000217c5068c5da07ccb1c0f8cce7ad767435"}], "x_generator": {"engine": "bippy-a5840b7849dd"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndma-buf/sync_file: Don't leak fences on merge failure\n\nEach add_fence() call does a dma_fence_get() on the relevant fence. In\nthe error path, we weren't calling dma_fence_put() so all those fences\ngot leaked. Also, in the krealloc_array failure case, we weren't\nfreeing the fences array. Instead, ensure that i and fences are always\nzero-initialized and dma_fence_put() all the fences and kfree(fences) on\nevery error path."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-05-29T05:05:38.712Z"}}}, "cveMetadata": {"cveId": "CVE-2021-47305", "state": "PUBLISHED", "dateUpdated": "2024-08-04T05:32:08.577Z", "dateReserved": "2024-05-21T13:27:52.133Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-21T14:35:25.345Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: dma-buf/sync_file: Don't leak fences on merge failure", "id": "2282477", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282477"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-402", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndma-buf/sync_file: Don't leak fences on merge failure\nEach add_fence() call does a dma_fence_get() on the relevant fence. In\nthe error path, we weren't calling dma_fence_put() so all those fences\ngot leaked. Also, in the krealloc_array failure case, we weren't\nfreeing the fences array. Instead, ensure that i and fences are always\nzero-initialized and dma_fence_put() all the fences and kfree(fences) on\nevery error path."], "name": "CVE-2021-47305", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2021-47305\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-47305\nhttps://lore.kernel.org/linux-cve-announce/2024052127-CVE-2021-47305-e1c5@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 4.14.241, kernel 4.19.199, kernel 5.4.135, kernel 5.10.53, kernel 5.13.5, kernel 5.14"}